5e089b415c
Tasks 2 and 3 verified their work with throwaway scripts against a real spawned server that were never committed, so npm test protected none of it - index.ts's auth gate had zero automated coverage, and the @ts-nocheck agent-network.ts/self-improvement.ts rate-limit wiring had none beyond listTools(). Adds two hermetic integration suites (real spawned server, localhost only, no wallet/chain calls): - auth-gating.test.ts: both HTTP routes' 401/403 gating, the auth-before- session-lookup ordering, cross-identity rejection, token-leak scanning, and that the server survives all of it (the reviewer's severe finding - a missing early `return` after a 401 falls through into a second writeHead() and crashes the whole process via an unhandled rejection). - rate-limit-gating.test.ts: per-identity isolation and that exhaustion on a vector.ts tool also rate-limits agent-network.ts and self-improvement.ts tools for that identity, through the real registered tools rather than limiterFor() in isolation. Extends test/setup.ts additively (spawnServer/stopRawServer/RawServerHandle) so these tests can set MCP_AUTH_TOKENS and drive per-request Authorization headers by hand; startServer()/stopServer()/callTool() are unchanged and the existing run.test.ts still fails for exactly its pre-existing reason. Wires a new test:integration:auth script into CI's build-and-test job. All five mutations from the review were applied to a working-tree copy, built, and reverted per-mutation to prove the new tests actually fail: - removing either route's early `return` after a 401: caught (cascading ECONNREFUSED once the process crashes; a dedicated liveness test targets this directly) - the cross-identity check's undefined-lookup branch: not independently catchable - transports/sessionIdentities are always populated and cleared together, synchronously, so that state is unreachable via HTTP; documented in the report, verified a same-region operator-flip mutation IS caught cleanly - module-scope `identity` reference in self-improvement.ts: crashes the server at startup (ReferenceError at import time), caught via the before() hook - checkRateLimit restored to module scope in agent-network.ts: caught cleanly, isError:true / "rateLimiter is not defined" instead of the well-formed rate-limit text No file under any src/ changed. test:unit 67/67, test:smoke 26/26 (23 tools, 0 drift), typecheck clean, new suite 12/12. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
69 lines
1.3 KiB
YAML
69 lines
1.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-and-test:
|
|
runs-on: nixos
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=12288
|
|
|
|
- name: Unit tests
|
|
run: npm run test:unit
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=12288
|
|
|
|
- name: Tool inventory smoke test
|
|
run: npm run test:smoke
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=12288
|
|
|
|
- name: Auth gating and rate-limit integration tests
|
|
run: npm run test:integration:auth
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=12288
|
|
|
|
typecheck:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Typecheck
|
|
run: npm run typecheck
|
|
env:
|
|
NODE_OPTIONS: --max-old-space-size=12288
|